Accessibility checks behind your login
Your customers also use the pages after the login: their account, their orders, a dashboard. Add a test account, a session cookie or an access header, list the pages, and every scan logs in and checks them for accessibility after your public pages. Pro checks up to 3 pages behind a login, Agency up to 10. The password or session is encrypted and never shown again.
How to set it up
- Choose how we log in
Open a site, then Site settings, then Logged-in pages. Pick a test account, a session cookie or a header.
- List the pages
Add the pages to check, like /account or /orders. They have to be on your own site, and your plan sets how many.
- Test the login
Test login logs in once with a real browser and tells you if it worked. If not, it says why in plain words, like a wrong password or a code the site asked for.
- Scan
Every scan checks your public pages first, then logs in and checks the pages on your list. The report gets a card called “Pages behind your login”.
Three ways to log in
| Method | Use it when | What we need |
|---|---|---|
| Test account | Your site has a normal login page. | The login page, an email or username and a password. Add words that only show when logged in, like “Log out”, so we can tell it worked. |
| Session cookie | You log in with SSO or a code. | The name and value of a cookie from a logged-in browser. Sessions run out, and we tell you when it stops working. |
| Header | A staging site sits behind an access token. | A header name, like Authorization, and its value. We send it to your site only, never to other websites. |
Use a test account without two-step login, never a real customer’s. If the email and the password are on two screens, that works too.
What we check on those pages
- The automatic WCAG 2.2 A and AA rules, the same as on your public pages.
- The keyboard: can you reach everything, see where you are, and get out again.
- Zoom and layout: text at 200%, a narrow screen and wider text spacing.
- Video, motion and sound that start on their own.
- An AI review of alt text, links and headings.
Behind the login we skip the pop-up and form tests and the phone-width check, so nothing is sent from your account. A page that sends us back to the login page is skipped, and the report says so.
How we keep the login safe
- The password, cookie or header value is encrypted (AES-256-GCM) with a key kept on our server, and tied to that one site.
- It is never shown again, not even to you. To change it, type a new one.
- It is opened only for the scan or test that uses it. It is never written to our logs, and we take no screenshots while logging in.
- We only log in to your own site: its address, its www twin or a subdomain. If the login page sends us to another website, we type nothing.
- Once logged in, we never open or press log out, delete or cancel, and we send nothing to other websites.
- The activity log notes the method and how many pages, never the username, password or value.
- Remove the login at any time and we delete what we saved. Scans go back to your public pages only.
Who gets what
Admins set up, change and remove the login. Members can test it. Everyone else in the workspace sees the setup, without the password or value.
| Plan | Pages behind a login |
|---|---|
| Free | Not included |
| Starter | Not included |
| Pro | Up to 3 |
| Agency | Up to 10 |
If you move to a plan with fewer pages, we check the first ones on your list. On a plan without it, the login is not used, and you can still remove it.
Related
Common questions
Which plans can check pages behind a login?
Pro and Agency. Pro checks up to 3 pages and Agency up to 10. Other plans check public pages only.
Is it safe to give untick a password?
Use a test account made for this, without two-step login and without real customer data. We encrypt the password, never show it again, and only type it on your own login page.
My site uses SSO or a one-time code. Can it still work?
Yes. Log in yourself in a browser, copy the session cookie and paste it. When the session runs out, we tell you, and you paste a fresh one.
Could untick change something in the account?
We take care that it does not. Behind the login we skip form and pop-up tests, send nothing to other websites, and never open or press log out, delete or cancel. Still, use a test account, not one that matters.
Does it check cookies and trackers behind the login too?
No. Behind the login we check accessibility only. Cookie, consent and tracker checks run on your public pages.
Does a clean result mean my account pages are accessible?
Not on its own. Automated checks find many problems, but not all of them, and the report lists what still needs a person to look. It is not legal advice.
See what your own website does.
Free, no signup, about a minute for your homepage.